Typosquatting relies on users recognizing a familiar shape instead of reading the complete registered domain.
Check character substitutions
Look for zero and letter-o swaps, lowercase L and capital I confusion, doubled characters and omitted punctuation. Read the domain slowly in plain text.
A single changed character creates a different destination even when the logo and page layout match.
Separate subdomain from registered domain
A trusted-looking phrase at the far left may only be a subdomain of an unrelated domain. Identify the registrable domain before evaluating the rest.
Paths after a slash can also contain any brand wording without affecting ownership.
Question added urgency words
Lookalike domains often add terms such as secure, login, update, official or verify. Those words describe a claim; they do not prove it.
Compare the entire address with a dated, attributable reference.
Use multiple visual formats
View the domain in the browser, plain text and a monospaced font. Different presentations can reveal characters that look similar in one font.
Internationalized domains require extra care because visually similar characters may use different scripts.
Stop when the spelling is uncertain
Do not enter credentials or continue through redirects while resolving a spelling question. Record the suspected difference and seek independent confirmation.
A verification-pending result is appropriate when the exact domain cannot be established.